license: other license_name: lil-license-1.0 license_link: LICENSE base_model: local-inference-lab/Qwen3.8-Flash-Next-FLARE base_model_relation: finetune pipeline_tag: image-text-to-text tags:

• flare
• nvfp4
• mxfp8
• abliterated
• reduced-refusal

This model is based on Qwen3.8-Flash-Next-FLARE by Local Inference Lab, Inc., a non-profit organization, available at https://huggingface.co/local-inference-lab/Qwen3.8-Flash-Next-FLARE. Qwen3.8-Flash-Next-FLARE is licensed under the Local Inference Lab License, Version 1.0.

Qwen3.8-Flash-Next-FLARE-Abliterated

Reduced-refusal model. A refusal-direction edit was applied on purpose. Measured refusal is 0/100 where the unedited parent refuses 100 %. Read the Safety section before you deploy this.

The gb202 Flare runtime package with abliterated weights patched in place. The compiled CUDA kernels, the captured execution graphs, the PLE n-gram table, the tokenizer and every signature are byte-identical to the upstream package.

hf download huginnfork/Qwen3.8-Flash-Next-FLARE-Abliterated \
  --revision gb202 --include '*.safetensors' --local-dir ./models
hf download huginnfork/Qwen3.8-Flash-Next-FLARE-Abliterated \
  --include 'publisher.json' --local-dir .

flare run ./models/qwen3.8-flash-next-tp1-c16-mtp5.safetensors \
  --gpus 0 --embedding-table-storage disk \
  --publisher-keys ./publisher.json \
  --dangerously-approve-key 937c0143f6856d3ee8ad164f62e3d804bd825d7a8750d0accb9a5849f703a8c1 \
  --dangerously-accept-publisher local-inference-lab

Read this first — three operational facts

1. Do NOT pass --verify-weights. It will fail. The package carries a single digest over its whole 77.78 GB weight region, and editing weights invalidates it. We cannot re-sign: the Flare binary exposes only run, download, agent and trust, and no public tool writes these packages. Without the flag it loads and serves normally, because the signature covers the metadata, which we did not touch, and the weight digest is only checked on request. With the flag you get stored-data content verification failed after about 190 s. You therefore cannot cryptographically verify these weights — check the SHA-256 below instead.

2. The signing key is still Local Inference Lab's. We did not re-sign, so the package authenticates as theirs, which is why the command approves their fingerprint and why publisher.json here is their profile copied unchanged. That is not an endorsement — see Licence.

3. You need CUDA 13.2 or newer. Measured on this package and the upstream one alike:

Inherited from upstream: one GPU, TP1, up to 16 concurrent requests, up to 5 MTP draft tokens. Flare rejects temperature=0 ("greedy decoding incorrectly collapses the model's probability distribution"); 0.01 is accepted.

Measured behaviour

Protocol A, the regime the direction was captured in: thinking disabled, 256-token budget, temperature=0.01, public treadon/abliteration-eval harmful split, scored on refusal form markers.

The interim row is the useful one. Editing every routed-expert down_proj and nothing else leaves refusal at about 21 %. Adding just 100 more tensors — the attention and shared-expert write projections, embed_tokens and ple.value_proj — takes it to zero. Those 100 are 0.4 % of the edit by count and carry the remaining fifth of the behaviour.

Scorer warning. A keyword scorer returns 68.8 % on the same responses from the interim build, because words like "illegal" occur inside answers that comply. Only refusal-form markers give the figures above. A refusal number is a protocol and scorer pair, and both halves move it a long way.

Not measured on this package: capability profiles, long-context retrieval, GPQA, MTP acceptance, vision. For those, see the plain-checkpoint build linked below, whose weights these are.

What was edited

A rank-1 refusal direction, biprojected against the harmless mean, captured at layer 46. The same direction as huginnfork/Qwen3.8-Flash-Next-NVFP4-MXFP8-CSF-QAD-Abliterated, whose measurements/direction_v4.npz is the committed artefact and whose measurements/ directory holds the full evaluation of these weights.

Deliberately not patched: the 512 MTP routed-expert down_proj planes. Their storage region could not be identified, and the 0/100 result shows they are not needed — the MTP head only proposes draft tokens, which the edited main model then verifies. No scale tensor was touched anywhere.

How the layout was found

Flare stores NVFP4 weight nibbles verbatim from its source checkpoint, which is what makes an in-place edit possible. Established empirically:

• a 512-plane storage region holds down_proj for experts 0..511 of one layer, expert e at region + e × 819200
• a 1024-plane region interleaves the other two in pairs: up_proj[e] at 2e, gate_proj[e] at 2e+1
• expert regions were identified by matching their first plane against expert-0 planes from the parent; the other 100 targets were found by a 612-probe Aho-Corasick pass over the non-expert regions

Every one of those 100 offsets was confirmed by a full-tensor byte comparison against the parent before anything was written — 100 confirmed, 0 rejected. Expert writes were additionally guarded: a patch altering more than 40 % of a plane was refused as a wrong-offset signal. Every write was read back. 24,676 written, 0 failures.

Scales are stored expanded, not in the CSF form of the source — 50 regions of exactly 512 × 102,400 bytes, and no region family at the packed size. A scale-touching edit would need that layout reverse-engineered. Ours does not touch scales.

Verifying this download

file   : qwen3.8-flash-next-tp1-c16-mtp5.safetensors   (revision gb202)
size   : 107,011,338,717 bytes
sha256 : fff1962065e4b09858bf700646336243ab18faf9900dad9c4f8486345032ef3d

Upstream is c3db5e1ac63b05efa67d6525826a8a792c0ce92b810e91ddd5ec0f42c73a175c, identical size. The two differ only inside the 22,268,149,760 bytes of weight extent listed above.

Limitations

• --verify-weights fails, so integrity cannot be checked cryptographically.
• 512 MTP routed experts are unedited. Expect no refusal effect; MTP draft acceptance was not measured.
• One GPU, TP1. Multi-host RoCE is DGX Spark (arm64) only — the amd64 Flare binary does not link libibverbs.
• CUDA 13.2 or newer required.
• These files require Flare. They cannot be loaded by Transformers, vLLM, SGLang or llama.cpp, and Flare cannot load an ordinary checkpoint.
• Refusal was measured at n=100 in one regime with one scorer. That is a measurement, not a property.

Safety

Refusal behaviour has been deliberately and substantially removed. This model answers requests the parent declines, including harmful ones. Do not deploy it as a general-purpose assistant without your own safeguards, and do not read 0/100 as a safety property.

Counter-intuitively, thinking-off is the harder regime: the unedited parent refuses 100 % there against 89.7 % with thinking on. Numbers from different regimes are not comparable.

Licence

Local Inference Lab License, Version 1.0. See LICENSE, NOTICE and LICENSES/, copied unchanged from the licensor's distribution, with the Identifying Marks intact.

Redistribution of this derivative is by permission of the licensor under Section 2.4. Local Inference Lab does not sponsor or endorse this model or its authors, and nothing here should be read as approval of a reduced-refusal build. The upstream model remains under the Qwen Community License 1.0; see LICENSES/LicenseRef-qwen-community-1.0.txt. If you operate a Model-as-a-Service or AI-assistant business, that licence requires a separate licence from Qwen before commercial use.

Credits: Qwen/Qwen3.8-Flash-Next by Qwen. The Flare runtime, the NVFP4-CSF container format, the b12x kernels and the prepared package this edits are all by Local Inference Lab, Inc.